Physical Protection (PE)
Level 2
Enforce safeguarding measures for CUI at alternate work sites.
Risk Assessment (RA)
Level 2
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Risk Assessment (RA)
Level 2
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Risk Assessment (RA)
Level 2
Remediate vulnerabilities in accordance with risk assessments.
Risk Assessment (RA)
Level 3
Employ threat intelligence, at a minimum from open or commercial sources, and any DoD-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
Risk Assessment (RA)
Level 3
Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.
Risk Assessment (RA)
Level 3
Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
Risk Assessment (RA)
Level 3
Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
Risk Assessment (RA)
Level 3
Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident, to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
Risk Assessment (RA)
Level 3
Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
